Chainguard Libraries

Chainguard is a software supply-chain security company that provides trusted open-source artifacts for containers, language libraries, VM images, CI/CD actions, and AI agent skills. Its artifacts are rebuilt from source, include verified manifests, provenance and software bills of materials, and are designed to replace vulnerable or malicious public packages. Chainguard also offers CVE backports, hardened actions and community skills, sandbox-based package analysis for suspicious behavior, Helm charts, and an agent called Guardener. Its container service includes rapid remediation commitments, including a one-day SLA for known exploited vulnerabilities; the videos also describe a minimal rolling Linux distribution with 1-, 7-, and 14-day remediation SLAs. The company is associated with the creators of Kubernetes, Sigstore, SLSA, and Google Distroless.

Chainguard Actions are hardened, drop-in replacements for GitHub Actions CI/CD steps. They are designed to protect CI/CD pipelines and privileged code from supply-chain risks; Chainguard's site describes a catalog of more than 1,000 CI/CD actions as part of its trusted open-source artifact offerings.

Chainguard Containers are hardened container images from Chainguard, built from source and rebuilt daily. The images include verified manifests and provenance information, attached software bills of materials, and vulnerability remediation commitments; Chainguard says its catalog contains more than 3,000 images with substantially fewer CVEs than public alternatives. The images are distributed through Chainguard's registry and are intended to reduce the vulnerability and malware exposure of containerized applications.

Chainguard Agent Skills is a Chainguard service for distributing hardened versions of third-party AI-agent skills. Chainguard processes upstream skills through deterministic and agentic hardening steps; organizations can also submit their own skills for hardening and internal sharing. Chainguard’s homepage describes the offering as a collection of more than 1,000 hardened community skills intended to protect against malicious instructions.

Wolfi is Chainguard's minimal, rolling-release Linux distribution, built from the ground up for software supply-chain security. It follows upstream code closely, with Chainguard rebuilding its images frequently rather than maintaining long-lived stable versions. Wolfi is part of Chainguard's broader catalog of trusted open-source artifacts and container images, which the company says are rebuilt from source daily and supplied with provenance verification and software bills of materials.